actual/.github/workflows/docs-spelling.yml

name: Check Spelling (Docs)

# Spell-checks the documentation under packages/docs using crate-ci/typos.
#
# This replaces the previous check-spelling/check-spelling action, whose
# upstream repository was archived and shipped a self-disabling "secpoll"
# kill-switch after a maintainer-account compromise (2026-06-16). typos is
# actively maintained, runs entirely from the checked-out tree, and needs
# no PR-comment or bot-apply machinery, so the workflow only requires
# read access to the repository contents.
#
# Configuration (allowlist, excluded files) lives in
# .github/actions/docs-spelling/typos.toml.

on:
  push:
    branches:
      - '**'
    tags-ignore:
      - '**'
    paths:
      - 'packages/docs/**'
      - '.github/workflows/docs-spelling.yml'
      - '.github/actions/docs-spelling/**'
  pull_request:
    paths:
      - 'packages/docs/**'
      - '.github/workflows/docs-spelling.yml'
      - '.github/actions/docs-spelling/**'
    types:
      - 'opened'
      - 'reopened'
      - 'synchronize'

permissions:
  contents: read

jobs:
  spelling:
    name: Check Spelling
    runs-on: depot-ubuntu-latest
    concurrency:
      group: spelling-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: true
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Read-only spell-check job; no authenticated git operations needed.
          persist-credentials: false
      - name: Spell check docs
        uses: crate-ci/typos@8951ef9cb569c860bc8f3f18070fbfaf65cdb349 # v1.30.0
        with:
          files: ./packages/docs
          config: .github/actions/docs-spelling/typos.toml